PT0-002 Planning and Scoping Practice Test 4 — 15 Questions

Question 1

A penetration tester is hired to perform a test with no prior knowledge of the target environment. The tester is given only the company name and must gather all necessary information from public sources. Which type of penetration test is this?

Accepted Answer

Black box. In a black box test, the tester has no prior knowledge or credentials, simulating an external attacker.

Answer

Grey box

Answer

Red team

Answer

White box

Question 2

During the pre-engagement phase, which document defines the IP ranges, test windows, and emergency stop criteria for a penetration test?

Accepted Answer

Rules of Engagement (RoE). The Rules of Engagement (RoE) document specifies technical constraints like IP ranges, timing, and stop conditions.

Answer

Get-out-of-jail letter

Answer

Non-Disclosure Agreement (NDA)

Answer

Statement of Work (SOW)

Question 3

A penetration tester is planning an engagement that includes testing a web application hosted on a third-party cloud provider. The client has provided credentials for the application but not for the underlying infrastructure. Which of the following should the tester do before proceeding?

Accepted Answer

Obtain written permission from the cloud provider. Third-party services require explicit permission from the provider to test; the tester must obtain written authorization.

Answer

Ignore the third-party aspect and test as usual

Answer

Ask the client to move the application to on-premises

Answer

Proceed with testing the application using the provided credentials

Question 4

The penetration tester identifies that a web application is hosted on a server that also contains sensitive customer data unrelated to the test. The SOW clearly states that only the web application is in scope. The tester accidentally accesses the customer data. What should the tester do immediately?

Accepted Answer

Report the incident to the client and stop testing. If out-of-scope data is accessed, the tester should stop, report, and follow the incident response plan without further investigation.

Answer

Delete the data and continue as planned

Answer

Continue testing and ignore the data

Answer

Analyze the data to find vulnerabilities

Question 5

A penetration testing engagement requires testing a production environment during business hours. The client is concerned about potential service disruption. Which document should specify the conditions under which the test must be halted?

Accepted Answer

Rules of Engagement. The Rules of Engagement (RoE) is the definitive document that outlines the scope, authorization, and constraints of a penetration test, including explicit conditions under which testing must be halted to prevent service disruption. Unlike other documents, the RoE is a legally binding agreement that specifies technical boundaries such as IP ranges, testing windows, and stop conditions (e.g., CPU threshold exceeded or application error rate spike). This ensures the client's production environment is protected during business hours.

Answer

Get-out-of-jail letter

Answer

Communication plan

Answer

Statement of Work

Question 6

During a social engineering engagement, a tester is authorized to target employees via email phishing. However, the tester accidentally sends a phishing email to a contractor who is not listed in the personnel scope. The contractor reports the email to the client's security team, causing an internal investigation. Which of the following best describes the tester's mistake?

Accepted Answer

Failure to follow the Rules of Engagement. Personnel scope must be clearly defined; the tester failed to adhere to the scoping requirements for social engineering.

Answer

Breach of the Non-Disclosure Agreement

Answer

Mishandling of discovered criminal activity

Answer

Violation of the Computer Fraud and Abuse Act (CFAA)

Question 7

A penetration tester is conducting a red team exercise. The goal is to simulate an advanced persistent threat (APT) and test the organization's detection and response capabilities. Which of the following engagement types best describes this scenario?

Accepted Answer

Red team exercise. A red team exercise (Option B) is the correct engagement type because it simulates an advanced persistent threat (APT) by emulating real-world adversarial tactics, techniques, and procedures (TTPs) across multiple attack vectors, with the primary objective of testing the organization's detection and response capabilities. Unlike a standard penetration test, a red team exercise is goal-oriented (e.g., gaining access to a specific system or data) and often operates under a covert or no-notice scenario, requiring the team to bypass security controls and evade detection over an extended period.

Answer

Wireless penetration test

Answer

Network penetration test

Answer

Web application penetration test

Question 8

Which of the following is the primary purpose of a get-out-of-jail letter?

Accepted Answer

To provide legal authorization for the tester to perform the test. A get-out-of-jail letter provides authorization and protects the tester from legal liability when performing authorized tests.

Answer

To outline the deliverables

Answer

To establish a communication plan

Answer

To define the rules of engagement

Question 9

A client requests a penetration test that includes testing of both internal network devices and a public-facing web application. The tester is provided with a VPN account for internal access but no credentials for the web application. Which type of penetration test is this?

Accepted Answer

Grey box. Grey box testing involves partial knowledge; the tester has internal network access but not web app credentials.

Answer

White box

Answer

Red team

Answer

Black box

Question 10

During a penetration test, the tester discovers evidence of an ongoing criminal activity, such as unauthorized data exfiltration by an insider. The client's legal team has not provided specific guidance on handling such discoveries. According to best practices and legal considerations, what should the tester do first?

Accepted Answer

Stop testing and report the finding to the client immediately. The tester should immediately stop testing and report the finding to the client point of contact, preserving evidence without further investigation to avoid legal complications.

Answer

Continue testing to gather more evidence

Answer

Contact law enforcement directly

Answer

Ignore the finding as it is out of scope

Question 11

A penetration tester is preparing a proposal for a client. The client wants a test that includes a detailed technical report with remediation steps and an executive summary for management. Which standard or framework is most commonly used to structure the testing process from pre-engagement through post-engagement?

Accepted Answer

PTES. The Penetration Testing Execution Standard (PTES) provides a comprehensive framework covering all phases from pre-engagement to post-engagement.

Answer

OWASP Testing Guide

Answer

OSSTMM

Answer

NIST SP 800-115

Question 12

After completing a penetration test, the tester must submit deliverables and then destroy all test artifacts. Which legal or ethical consideration primarily drives the requirement to destroy test artifacts?

Accepted Answer

The statement of work (SOW) and NDA. Data handling and destruction are required to protect client confidentiality and comply with privacy laws and contractual agreements.

Answer

Privacy laws such as GDPR or HIPAA

Answer

Computer Fraud and Abuse Act (CFAA)

Answer

Vulnerability disclosure responsibilities

Question 13

A penetration tester is scoping a network penetration test for a client that uses multiple third-party services. Which TWO of the following are correct actions regarding third-party services? (Select TWO.)

Accepted Answer

Exclude third-party services from testing unless explicitly authorized. Option D is correct because third-party services are outside the penetration tester's authorized boundary unless explicitly included in the scope definition. Testing without explicit authorization could violate the third-party's terms of service, the Computer Fraud and Abuse Act (CFAA), or similar laws. Scope must be clearly defined in the Rules of Engagement (RoE) to avoid legal and contractual breaches.

Answer

Include all third-party services in scope without restriction

Answer

Assume that third-party services are out of scope

Answer

Test third-party services without informing the provider

Question 14

A penetration testing company is planning a social engineering engagement for a client. The engagement includes phishing and physical tailgating. Which THREE of the following should be clearly defined in the Rules of Engagement? (Select THREE.)

Accepted Answer

The conditions under which the test must be stopped immediately. RoE should address personnel scope, emergency stop conditions, and specific techniques allowed; vulnerabilities and deliverables are part of SOW.

Answer

The format of the final report

Answer

The specific vulnerabilities to be exploited

Question 15

A penetration tester has completed a web application test and is preparing the final deliverables. According to best practices, which THREE components should be included in the deliverables? (Select THREE.)

Accepted Answer

Detailed technical findings with evidence. Option B is correct because penetration testing deliverables must include detailed technical findings with evidence, such as proof-of-concept exploit code, HTTP request/response pairs, or screenshots, to validate each vulnerability. This aligns with PT0-002 best practices, ensuring the client can reproduce and understand the issue without ambiguity.

Answer

Raw vulnerability scan output

Answer

Full source code of the application